My supplier does not provide the data — what can I do?

Article 38 provides the hook, not the guarantee

Yes, there is a legal basis to request data from a supplier: Article 38 of the ESPR (Regulation (EU) 2024/1781) obliges actors in the supply chain to provide the information necessary to comply with the regulation's requirements, including the data for the digital product passport. This does not mean that data will automatically be provided as soon as it is requested. The regulation places the obligation on the supplier, but responsibility for the passport itself remains with the manufacturer or importer, according to Article 27 of the same regulation. In other words: Article 38 is the argument by which data can be requested, but it does not change who is held accountable if the passport ultimately does not materialise. Those who depend on a supply chain partner for critical data would therefore be well advised to make that dependency visible now — in their records and, where possible, in their procurement agreements.

For manufacturers and importers, not for every supply dispute

This topic concerns the situation in which a supplier within a product's supply chain fails to provide the technical or material data needed to compile the digital product passport. It therefore concerns information provision under the ESPR, not a general commercial dispute over late delivery, quality or product price — those are governed by ordinary contractual and civil law rules, separate from the ESPR. It also concerns specifically actors in the supply chain as defined in Article 38: parties that supply components, materials or parts to the entity placing the product on the market. A dispute with a customer, distributor or service provider outside that chain does not fall within this scope. And importantly: Article 38 operates within the framework of the ESPR as a whole — the specific data required for a product group are only set out in the delegated act for that group. Without a published delegated act for electronics and ICT, there is as yet no defined list of data that a supplier would be obliged to provide on this basis.

No fixed date yet: the work plan names 2027 as the earliest point

No delegated act for electronics and ICT equipment has yet been published. The European Commission's work plan for 2025-2030 names delegated acts for these categories from 2027 onwards, by product subcategory. As long as such an act is not in place, there are as yet no concrete obligations for electronics and ICT to provide passport data — not for the manufacturer or importer, and therefore not for their suppliers on the basis of Article 38. What is in place until then is the general framework of the regulation itself: the division of roles between manufacturer and supply chain, as described in Articles 27 and 38, is already fixed. Once the delegated act for a product subcategory has been published, its date and content will be added here.

Four steps in practice

If you are already dealing with a supplier who does not provide relevant data, it would be wise to tackle this in four steps. First: check whether your own product already falls under a published delegated act — without an act, there is no direct legal obligation based on Article 38 for that specific product group, but one is coming. Next: document your request to the supplier in writing, with a clear description of which data are needed and for what purpose. Then: include this obligation in new or renewed supply contracts and purchasing terms where possible, so that the supply does not rely solely on the regulation but is also contractually documented. Finally: keep your own responsibility as a manufacturer or importer in mind — Article 27 places that responsibility with the person placing the product on the market, so missing data from a supplier does not release that party from their own obligation. Documentation of requests made and attempts to obtain data is therefore not an unnecessary luxury, but part of demonstrating careful conduct.

The basis: Article 38 and Article 27 of the ESPR

This explanation is based on two articles from Regulation (EU) 2024/1781. Article 38 sets requirements for actors in the supply chain and thus forms the legal basis for requesting data needed to comply with the regulation — including the product passport — from a supplier. Article 27 describes the obligations of manufacturers and confirms that responsibility for the passport remains with them, regardless of where in the chain the underlying data must come from. For the exact wording and scope of both articles, the official text on EUR-Lex is the appropriate source.

If you are already dealing with this dependency, you can start by mapping which suppliers provide which data, documenting this in your own administration, and engaging with suppliers about future data provision now — well before a delegated act makes obligations concrete for your own product group.